CVE-2026-101915
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
- Record
CVE-2026-101915- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-550
- Updated
- 2026-11-02
EUVDEUVD-2026-88468
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
- Record
EUVD-2026-88468- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f596-whhp-79r4
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Impact
If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.
Patches
This vulnerability is fixed in 1.13.6 and 1.14.5.
Workarounds
This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.
- Record
GHSA-f596-whhp-79r4- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-550
- Updated
- 2026-11-02
NVD
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
- Record
CVE-2026-101915- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-550
- Updated
- 2026-11-02
OSV
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
- Record
CVE-2026-101915- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-550
- Updated
- 2026-11-02
OSVGHSA-f596-whhp-79r4
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Impact
If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.
Patches
This vulnerability is fixed in 1.13.6 and 1.14.5.
Workarounds
This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.
- Record
GHSA-f596-whhp-79r4- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-550
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1792603525 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 0.6.9-tuxcare.1.
- Record
CLSA-2026-1792603525- Updated
- 2026-11-02
OSVCLSA-2026-1792745507 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.3.8-tuxcare.1.
- Record
CLSA-2026-1792745507- Updated
- 2026-11-02
OSVCLSA-2026-1792745535 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.9.16-tuxcare.1.
- Record
CLSA-2026-1792745535- Updated
- 2026-11-02
OSVCLSA-2026-1792745716 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.1.
- Record
CLSA-2026-1792745716- Updated
- 2026-11-02
OSVCLSA-2026-1792746952 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.14.4-tuxcare.1.
- Record
CLSA-2026-1792746952- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grpc/grpc-jsnpm |
before 1.13.6 | 1.13.6 |
@grpc/grpc-jsnpm |
1.14.0 up to 1.14.5 | 1.14.5 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
0.6.9-tuxcare.0 up to 0.6.9-tuxcare.1, plus listed versions 0.6.9 |
0.6.9-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.3.8-tuxcare.0 up to 1.3.8-tuxcare.1, plus listed versions 1.3.8 |
1.3.8-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.9.16-tuxcare.0 up to 1.9.16-tuxcare.1, plus listed versions 1.9.16 |
1.9.16-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.12.6-tuxcare.0 up to 1.12.6-tuxcare.1, plus listed versions 1.12.6 |
1.12.6-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.14.4-tuxcare.0 up to 1.14.4-tuxcare.1, plus listed versions 1.14.4 |
1.14.4-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-101915 is a low vulnerability (CVSS 3.7) in Grpc Grpc-node, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in @grpc/grpc-js 1.13.6.
References
github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4